Victim of cybercrime: Pay or not?

May 16, 2022 | Sharina Henriquez

Oranjestad – Pirates are increasingly affecting the daily lives of Aruba’s citizens. And also businessmen, such as the well-known media personality and presenter Ivo Yanez. “It was awful. I lost everything: my software, my photos, all the information. Ten years of work are suddenly gone.”

Yanez’s Facebook page was hacked last year. How do? he do not know. His entire page was later removed and the damage to his company was extensive.

“I had 46,000 followers. That is a lot for a country like Aruba with a population of 110,000. I did everything with it. Then I had to start from scratch again. It is terrible, I would not wish that to anyone.”

The biggest breakthrough in Aruba
The biggest known hack in Aruba was in 2019 when the only hospital in Aruba was held hostage by a ransomware virus. Then Horacio Oduber Hospital (HOH) decided not to pay. But creating a new network cost the hospital millions of guilders.

“Given the past, it might have been wise to pay the ransom,” hospital director Jaco Frogop said last year. Caribbean Network. But is this really so wise?

Don’t pay, this is an increasingly evident development in the United States, for example. Companies that would rather pay hackers and negotiate ransoms than build a new network. An important reason is reputational damage. They don’t want customers to lose trust because they’ve heard that the company has been hacked.

Dolphi Richardson, director of NCTVI photo: Sharina Henriquez

The Aruba Cyber ​​Security Task Force says that “unofficially” there are more cases of ransomware in Aruba. According to the working group, there are companies that have chosen to pay the ransom.

‘We don’t pay criminals’
“But the ransom amount is not always the problem,” said Dolphi Richardson, director of the National Central Bureau of Counter-Terrorism, Security and Interpol (NCTVI) and a member of the task force. “Even if you get the key from the hacker to regain access to your system, you can never trust him again. Because what else did they hide? They can then come again for ransom later.”

“Plus, what would be the effect on others if everyone started paying? Anyway, the government’s policy is: We don’t pay criminals,” Richardson says.

Paul Ellens, who works on the task force on behalf of telecoms company Setar, says the same. “In America, by the way, there is a debate to make it illegal to negotiate with hackers and pay for ransomware. Because insurance companies have jumped on it too; as a company you can insure yourself against cybercrime.” “You almost get insurance companies and criminals to cooperate, which is a really impossible development,” Richardson adds.

“Cooperation between insurance companies and criminals, that really isn’t possible”

– Dolphy Richardson, Director of NCVI

The task force recognizes that there is a strong reluctance to report cyber incidents. But a new law is on the way with a notification requirement.

Insiders say that a major bank on the island recently fell victim to ransomware, which would have cost the company a lot of money. But no client knows, because the bank is afraid to damage its reputation.

I’m still ashamed of it
By the way, it is not only companies that prefer to hide hacking attacks. Victim Marco* does not want to use his name because he still feels ashamed. “My email account has been hacked. I just bought a software online. And a day later I got an email from the software vendor apparently. I got a free feature because I bought the software. Turns out this email is not from that company at all. But I actually clicked on the link and by that time it was too late.”

“The worst thing is that others also become victims because of me.”

– Marco*, email hack victim

The damage was significant, in the sense that Marco used his email for all kinds of other accounts. Such as banking, AZV application, his mobile phone, his children’s school affairs, subscriptions. “So go and change all that. I made a whole list,” he says. “But then it turns out I’m missing a lot. You just don’t know what you’re using for your email anymore.”

But worst of all, he believes that others, family, and friends can also be the victims. “The hacker has all my contacts. All emails containing personal information, as well as from others.”

No to the police?
Local celebrity Ivo Yanez did not file a police report. “I was looking for a team to find out and they think the hackers are not from Aruba. The investigation is not over yet. I have also lodged a complaint with Facebook, but haven’t heard from them yet.”

Marco also did not go to the police. “I don’t think that makes sense. I’ve already heard that the police can’t solve a burglary. Sometimes I also think that if you put too much effort into it, hackers might come back. And other things much worse. That’s why it’s so annoying. You’ll remain a kind of eternal victim And the goal.”